magus-cli 7.0.0 → 7.2.0

package/src/services/claude-settings.ts

@@ -816,24 +816,15 @@ async function writeKnownMarketplaces(
 }
 
 /**
- * Set autoUpdate flag for a marketplace in known_marketplaces.json
- * This is where Claude Code actually reads the autoUpdate setting
- */
-export async function setMarketplaceAutoUpdate(
-	marketplaceName: string,
-	autoUpdate: boolean,
-): Promise<boolean> {
-	const known = await readKnownMarketplaces();
-	if (known[marketplaceName]) {
-		known[marketplaceName].autoUpdate = autoUpdate;
-		await writeKnownMarketplaces(known);
-		return true;
-	}
-	return false; // Marketplace not yet installed by Claude Code
-}
-
-/**
- * Get autoUpdate status for a marketplace
+ * Read a marketplace's `autoUpdate` flag — Claude Code's refresh policy.
+ *
+ * READ ONLY, and there is deliberately no setter. `autoUpdate` is Claude Code's
+ * field (50 occurrences in the 2.1.269 binary, with its own manifest-schema
+ * entry and a "Synced autoUpdate= from settings" path), so Claude Code decides
+ * its value. magus used to write `true` into every MadAppGang entry on TUI
+ * startup, which is a direct write to `known_marketplaces.json` — the file at
+ * the top of CLAUDE.md's never-write-directly list — and it fought Claude Code's
+ * own sync for ownership of the same byte.
  */
 export async function getMarketplaceAutoUpdate(
 	marketplaceName: string,
@@ -843,7 +834,6 @@ export async function getMarketplaceAutoUpdate(
 }
 
 export interface MarketplaceRecoveryResult {
-	enabledAutoUpdate: string[];
 	removed: string[];
 	reregistered: string[];
 }
@@ -1189,24 +1179,19 @@ export async function migrateMarketplaceRename(
 	return result;
 }
 
-/**
- * Check if a marketplace is from Magus (MadAppGang)
- */
-function isMadAppGangMarketplace(entry: KnownMarketplaceEntry): boolean {
-	const repo = entry.source?.repo?.toLowerCase() || "";
-	return repo.includes("madappgang");
-}
-
 /**
  * Recover/sync marketplace settings:
- * - Enable autoUpdate for Magus marketplaces that don't have it set
  * - Remove entries for marketplaces whose installLocation no longer exists
  * - Fix stale "directory" source for known Magus marketplaces that should be "github"
+ *
+ * It does NOT touch `autoUpdate`. It used to set it to `true` on every
+ * MadAppGang entry whose flag was unset, on every TUI startup — writing a
+ * Claude Code-owned field that Claude Code also syncs from settings. See
+ * {@link getMarketplaceAutoUpdate}.
  */
 export async function recoverMarketplaceSettings(): Promise<MarketplaceRecoveryResult> {
 	const known = await readKnownMarketplaces();
 	const result: MarketplaceRecoveryResult = {
-		enabledAutoUpdate: [],
 		removed: [],
 		reregistered: [],
 	};
@@ -1249,21 +1234,11 @@ export async function recoverMarketplaceSettings(): Promise<MarketplaceRecoveryR
 			}
 		}
 
-		// Enable autoUpdate if not set - only for Magus (MadAppGang) marketplaces
-		if (entry.autoUpdate === undefined && isMadAppGangMarketplace(entry)) {
-			entry.autoUpdate = true;
-			result.enabledAutoUpdate.push(name);
-		}
-
 		updatedKnown[name] = entry;
 	}
 
 	// Write back if any changes were made
-	if (
-		result.enabledAutoUpdate.length > 0 ||
-		result.removed.length > 0 ||
-		result.reregistered.length > 0
-	) {
+	if (result.removed.length > 0 || result.reregistered.length > 0) {
 		await writeKnownMarketplaces(updatedKnown);
 	}
 

package/src/services/local-marketplace.ts

@@ -64,17 +64,73 @@ interface KnownMarketplaceEntry {
 type KnownMarketplaces = Record<string, KnownMarketplaceEntry>;
 
 /**
- * Read known_marketplaces.json (Claude Code's internal marketplace tracking)
+ * Read known_marketplaces.json, or null when it cannot be read honestly.
+ *
+ * The null matters. {@link readKnownMarketplaces} collapses "absent",
+ * "unparseable" and "genuinely empty" into `{}`, which is fine for a lookup and
+ * catastrophic for a filter: intersecting the marketplaces directory against an
+ * empty registry deletes every marketplace, and every installed plugin then
+ * reports as no longer published. A registry we could not read is UNKNOWN, and
+ * unknown must not render as a determinate negative.
  */
-async function readKnownMarketplaces(): Promise<KnownMarketplaces> {
+async function readKnownMarketplacesOrNull(): Promise<KnownMarketplaces | null> {
 	try {
-		if (await fs.pathExists(KNOWN_MARKETPLACES_FILE)) {
-			return await fs.readJson(KNOWN_MARKETPLACES_FILE);
+		if (!(await fs.pathExists(KNOWN_MARKETPLACES_FILE))) return null;
+		const parsed = await fs.readJson(KNOWN_MARKETPLACES_FILE);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+			return null;
 		}
+		return parsed as KnownMarketplaces;
 	} catch {
-		// Return empty if can't read
+		return null;
+	}
+}
+
+/**
+ * Read known_marketplaces.json (Claude Code's internal marketplace tracking)
+ */
+async function readKnownMarketplaces(): Promise<KnownMarketplaces> {
+	return (await readKnownMarketplacesOrNull()) ?? {};
+}
+
+/**
+ * Directory names a parsed `known_marketplaces.json` registers, or null when it
+ * says nothing usable.
+ *
+ * Pure, and exported, because `scanLocalMarketplaces` resolves its paths from
+ * `os.homedir()` at module load and cannot be pointed at a temp directory. The
+ * decision this encodes is the part worth testing; the IO around it is not.
+ *
+ * Keyed by BOTH the registry key and the basename of `installLocation`: the two
+ * are normally equal and nothing enforces it, and dropping a real marketplace
+ * is far worse than keeping a stray directory.
+ *
+ * An empty object is an ANSWER — nothing is registered — and filters everything
+ * out. Only unusable input is null. The distinction lives in
+ * {@link readKnownMarketplacesOrNull}, which returns null for an absent file,
+ * so a machine that has never added a marketplace stays permissive.
+ */
+export function registeredMarketplaceNames(
+	parsed: unknown,
+): Set<string> | null {
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+		return null;
+	}
+	const names = new Set<string>();
+	for (const [name, entry] of Object.entries(
+		parsed as Record<string, unknown>,
+	)) {
+		names.add(name);
+		const loc = (entry as { installLocation?: unknown })?.installLocation;
+		if (typeof loc === "string" && loc.length > 0) {
+			names.add(path.basename(loc));
+		}
 	}
-	return {};
+	return names;
+}
+
+async function registeredDirNames(): Promise<Set<string> | null> {
+	return registeredMarketplaceNames(await readKnownMarketplacesOrNull());
 }
 
 /**
@@ -321,6 +377,19 @@ export async function scanLocalMarketplaces(): Promise<
 > {
 	const marketplaces = new Map<string, LocalMarketplace>();
 
+	// A directory is not a marketplace; a REGISTRY ENTRY is. Null means the
+	// registry could not be read, and then every directory is kept — see
+	// `registeredDirNames`.
+	//
+	// Claude Code refreshes a marketplace by delete-then-clone and leaves
+	// `<name>.bak` behind. An unfiltered scan treated that backup as a real
+	// marketplace, which cost the reporter twice: `magus.bak` shadowed the real
+	// `magus` in `getAllMarketplaces()` (deduped by repo, first-come) so the real
+	// one vanished from the plugin list entirely, and later it became the target
+	// of a nonsense label — `kanban@magus … moved → magus.bak`. `claude plugin
+	// marketplace list` never showed it, because Claude Code reads the registry.
+	const registered = await registeredDirNames();
+
 	// 1. Scan marketplaces from the standard directory
 	if (await fs.pathExists(CLAUDE_PLUGINS_DIR)) {
 		try {
@@ -330,6 +399,7 @@ export async function scanLocalMarketplaces(): Promise<
 
 			for (const entry of entries) {
 				if (!entry.isDirectory()) continue;
+				if (registered && !registered.has(entry.name)) continue;
 
 				const marketplacePath = path.join(CLAUDE_PLUGINS_DIR, entry.name);
 				const marketplace = await scanSingleMarketplace(

package/src/services/manifest.ts

@@ -52,6 +52,12 @@ export function migrateToV2(raw: unknown): ProfileManifest {
 	// Only carry strictVersions when enabled, so a committed manifest that
 	// doesn't opt in stays minimal (no spurious `"strictVersions": false`).
 	if (obj.strictVersions === true) manifest.strictVersions = true;
+	// Carried through even when it names no existing profile: dropping it here
+	// would silently "fix" a typo that `validateManifest` is meant to report,
+	// and the commands that read it all check the id resolves first.
+	if (typeof obj.default === "string" && obj.default !== "") {
+		manifest.default = obj.default;
+	}
 	return manifest;
 }
 
@@ -110,6 +116,21 @@ export function validateManifest(
 		errors.push({ path: "profiles", message: "no profiles defined" });
 	}
 
+	// A `default` naming nothing is worse than none: a fresh clone would fall
+	// through to asking, with no sign that the repo tried to answer and got the
+	// id wrong. Reported here so it fails the same gate every other manifest
+	// mistake does, rather than being discovered as silence.
+	if (manifest.default !== undefined) {
+		if (typeof manifest.default !== "string") {
+			errors.push({ path: "default", message: "must be a profile id" });
+		} else if (!ids.includes(manifest.default)) {
+			errors.push({
+				path: "default",
+				message: `no profile "${manifest.default}" — declared: ${ids.join(", ")}`,
+			});
+		}
+	}
+
 	for (const [id, entry] of Object.entries(manifest.profiles ?? {})) {
 		const base = `profiles.${id}`;
 		if (!entry || typeof entry !== "object") {

package/src/services/marketplace-refresh.ts

@@ -36,17 +36,6 @@ export interface RefreshResult {
 	failed: string[];
 	/** Nothing to do: no clone on disk, not a git repo, or dirty tree. */
 	skipped: string[];
-	/**
-	 * Skipped specifically because `autoUpdate: false` in known_marketplaces.json.
-	 *
-	 * Called out separately from `skipped` because the consequence is invisible
-	 * and open-ended: the clone is the catalog, so a marketplace opted out here
-	 * never learns about new plugin versions, and every plugin from it reads as
-	 * up to date forever. The reporter's `magus` clone sat 11 days behind this
-	 * way — Claude Code would not refresh it, and this function skipped it too,
-	 * with nothing printed either time.
-	 */
-	autoUpdateDisabled: string[];
 }
 
 function cloneDir(name: string): string {
@@ -198,7 +187,6 @@ export async function refreshRegisteredMarketplaces(
 	const refreshed: string[] = [];
 	const failed: string[] = [];
 	const skipped: string[] = [];
-	const autoUpdateDisabled: string[] = [];
 
 	const configured = await getConfiguredMarketplaces();
 	const skipSet = new Set(skip);
@@ -211,8 +199,13 @@ export async function refreshRegisteredMarketplaces(
 			skipped.push(name);
 			continue;
 		}
+		// Claude Code's own refresh policy. Honour it by not pulling, and say
+		// nothing: the version answer does not come from this clone.
+		// `readCatalogFromRemote` reads `origin/<branch>` with fetch + show, never
+		// the working tree — measured, a clone holding dev 7.4.0 with autoUpdate
+		// off still reported 7.4.1 available.
 		if ((await getMarketplaceAutoUpdate(name)) === false) {
-			autoUpdateDisabled.push(name);
+			skipped.push(name);
 			continue;
 		}
 		eligible.push(name);
@@ -226,7 +219,6 @@ export async function refreshRegisteredMarketplaces(
 			refreshed: [],
 			failed: [],
 			skipped: [...skipped, ...eligible],
-			autoUpdateDisabled,
 		};
 	}
 
@@ -249,5 +241,5 @@ export async function refreshRegisteredMarketplaces(
 		else skipped.push(name); // absent | skipped
 	});
 
-	return { refreshed, failed, skipped, autoUpdateDisabled };
+	return { refreshed, failed, skipped };
 }

package/src/services/plugin-manager.ts

@@ -122,15 +122,6 @@ export interface PluginInfo {
 	 * a reinstall delivers the current content. See content-drift.ts.
 	 */
 	contentStale?: boolean;
-	/**
-	 * For an orphaned plugin: another configured marketplace that publishes a
-	 * plugin of the same name — i.e. it did not disappear, it moved.
-	 *
-	 * Splitting `magus` into `magus` + `magus-marketing` left video-editing and
-	 * image-generate installed under a namespace that no longer lists them. Rendered as bare "deprecated", the only offered action
-	 * was deletion, which silently drops a plugin that is still published.
-	 */
-	movedTo?: string;
 	/**
 	 * Set when this plugin's installed version changed since magus last
 	 * rendered it — including updates made by Claude Code or a direct CLI call
@@ -467,9 +458,6 @@ export async function getAvailablePlugins(
 		// Try to get plugin info from local marketplace cache (fallback)
 		const localMp = localMarketplaces.get(mpName);
 		const localPlugin = localMp?.plugins.find((p) => p.name === pluginName);
-		const movedTo = localPlugin
-			? undefined
-			: findPluginInOtherMarketplace(pluginName, mpName, localMarketplaces);
 
 		const latestVersion = localPlugin?.version || installedVersion || "unknown";
 		const description = localPlugin?.description || "Installed plugin";
@@ -486,7 +474,6 @@ export async function getAvailablePlugins(
 			installedVersion: installedVersion,
 			hasUpdate,
 			isOrphaned: true,
-			movedTo,
 			...scopeStatus,
 		});
 	}
@@ -495,24 +482,6 @@ export async function getAvailablePlugins(
 	return plugins;
 }
 
-/**
- * Find another configured marketplace that still publishes this plugin name.
- *
- * Answers "did it disappear, or did it move?" for an orphaned plugin, so the
- * UI can offer migration rather than only deletion.
- */
-function findPluginInOtherMarketplace(
-	pluginName: string,
-	currentMarketplace: string,
-	localMarketplaces: Map<string, LocalMarketplace>,
-): string | undefined {
-	for (const [name, mp] of localMarketplaces) {
-		if (name === currentMarketplace) continue;
-		if (mp.plugins.some((p) => p.name === pluginName)) return name;
-	}
-	return undefined;
-}
-
 /**
  * Is this plugin one whose files could have moved while its version did not?
  *

package/src/services/profile-activate.ts

@@ -0,0 +1,147 @@
+/**
+ * Finish a migration: put a profile on disk and make the project run it.
+ *
+ * Adoption used to end at `writeManifest`, which is the whole reason migrating
+ * felt like it did nothing. "Active" is not a field anywhere — it is derived
+ * from whether `.claude/settings.json` is a symlink into `_profiles/<id>/`
+ * (see `activeProfile`). A manifest that nothing links to leaves the project in
+ * exactly the state it was in, so the next command still asks which profile to
+ * use, having just been told.
+ *
+ * The three steps have to happen together and in this order, which is why they
+ * live in one function rather than at each call site:
+ *
+ *   1. materialize — write `_profiles/<id>/`, or activation throws
+ *   2. gitignore   — before the links exist, or a symlink into generated state
+ *                    lands in `git status` (`.claude/` is committed)
+ *   3. activate    — point the four links at the profile
+ *
+ * No network and no installs: `resolveProfile` reads the manifest, and binary
+ * resolution is skipped outright because nothing here materializes bins. That
+ * matters — this runs inside a prompt the user answered, not inside `install`.
+ */
+
+import path from "node:path";
+import type { ProfileManifest } from "../types/index.js";
+import { ensureGitignoreEntries } from "./conventions-manager.js";
+import { writeManifest } from "./manifest.js";
+import { adoptCurrentProject } from "./profile-adopt.js";
+import { materializeProfile } from "./profile-materializer.js";
+import { resolveAllProfiles, resolveProfile } from "./resolver.js";
+import {
+	type DisplacedArtifact,
+	PROFILE_GITIGNORE_ENTRIES,
+	activateProfile,
+} from "./symlink-manager.js";
+
+/**
+ * Bins are declared by plugins and read from the marketplace cache, one
+ * `plugin.json` per plugin. Materialization writes settings, mcp, models and
+ * skills — never bins — so resolving them here would be pure latency, and on a
+ * machine with a cold cache it is latency inside a prompt.
+ */
+const noBins = async () => [];
+
+export interface ActivationResult {
+	/** The profile now live. */
+	profileId: string;
+	/** Hand-written artifacts moved aside to make room for the symlinks. */
+	displaced: DisplacedArtifact[];
+}
+
+/**
+ * Announce one displaced artifact, in project-relative terms.
+ *
+ * Shared by every command that activates, because a hand-written file moving is
+ * the same event whichever command caused it, and the one that is easiest to
+ * leave out: `activateProfile` returns the list, and a caller that discards the
+ * return value still compiles. `magus install` and `magus profile switch` both
+ * did exactly that.
+ *
+ * Paths are relative because absolute ones wrap over two terminal lines each,
+ * and this is the notice a user must not skim.
+ */
+export function reportDisplaced(
+	projectPath: string,
+): (artifact: DisplacedArtifact) => void {
+	const rel = (p: string) => path.relative(projectPath, p);
+	return ({ link, savedTo }) =>
+		console.log(`  ${rel(link)} → kept at ${rel(savedTo)}`);
+}
+
+/**
+ * Materialize `profileId` and make it the active profile.
+ *
+ * The union of plugin ids across EVERY profile is passed to materialization, so
+ * the profile writes an explicit `false` for plugins other profiles own. Without
+ * it an omitted id falls through to user scope and stays enabled, which would
+ * make the freshly adopted profile additive rather than a description of this
+ * project — the exact drift adoption was run to end.
+ */
+export async function materializeAndActivate(
+	manifest: ProfileManifest,
+	profileId: string,
+	projectPath: string,
+	/** Called as each artifact moves; defaults to printing it. */
+	onDisplace: (artifact: DisplacedArtifact) => void = reportDisplaced(
+		projectPath,
+	),
+): Promise<ActivationResult> {
+	const closure = await resolveProfile(manifest, profileId, {
+		binResolver: noBins,
+	});
+	const union = await resolveAllProfiles(manifest, { binResolver: noBins });
+
+	await materializeProfile(
+		profileId,
+		closure,
+		projectPath,
+		Object.keys(union.plugins),
+	);
+
+	await ensureGitignoreEntries(
+		path.join(projectPath, ".gitignore"),
+		PROFILE_GITIGNORE_ENTRIES,
+		"# magus: generated profile build output + active-profile symlinks",
+	);
+
+	const displaced = await activateProfile(profileId, projectPath, onDisplace);
+	return { profileId, displaced };
+}
+
+/** The two ways a project can be put onto a profile. */
+export type ProfileChoice =
+	| { kind: "adopt"; id: string }
+	| { kind: "activate"; id: string };
+
+/**
+ * Carry out the user's choice, whichever surface asked.
+ *
+ * One implementation because "migrate" is two writes that must not come apart —
+ * write the manifest, then link the project to it — and a second copy of that
+ * pairing in the other surface is how one of them ends up writing the manifest
+ * and stopping, which is the defect this whole area was fixed for.
+ */
+export async function applyProfileChoice(
+	choice: ProfileChoice,
+	manifest: ProfileManifest,
+	projectPath: string,
+	onDisplace?: (artifact: DisplacedArtifact) => void,
+): Promise<ActivationResult> {
+	if (choice.kind === "activate") {
+		return materializeAndActivate(manifest, choice.id, projectPath, onDisplace);
+	}
+	const result = await adoptCurrentProject(
+		projectPath,
+		undefined,
+		manifest,
+		choice.id,
+	);
+	await writeManifest(result.manifest, projectPath);
+	return materializeAndActivate(
+		result.manifest,
+		choice.id,
+		projectPath,
+		onDisplace,
+	);
+}

package/src/services/profile-adopt.ts

@@ -30,6 +30,21 @@ import { withDerivedMarketplaces } from "./resolver.js";
 /** The profile id used when adopting a project that has no manifest. */
 export const ADOPTED_PROFILE_ID = "default";
 
+/**
+ * First free profile id, so adopting never overwrites an existing profile.
+ *
+ * Lives here rather than at a call site because both surfaces adopt now — the
+ * CLI prompt and the TUI's startup offer — and two copies of "which id is
+ * free?" is two chances to overwrite somebody's profile.
+ */
+export function freeProfileId(manifest: ProfileManifest): string {
+	if (!manifest.profiles[ADOPTED_PROFILE_ID]) return ADOPTED_PROFILE_ID;
+	for (let n = 2; ; n++) {
+		const id = `${ADOPTED_PROFILE_ID}-${n}`;
+		if (!manifest.profiles[id]) return id;
+	}
+}
+
 export interface AdoptInput {
 	/** Union of enabled plugins across every scope: id -> enabled. */
 	enabledPlugins: Record<string, boolean>;
@@ -147,7 +162,7 @@ export type AdoptSource = "project" | "user";
  * everything globally would otherwise have nothing to adopt. The caller is told
  * which source was used and says so, so the choice is never invisible.
  */
-async function collectEnabledPlugins(
+export async function collectEnabledPlugins(
 	projectPath: string,
 ): Promise<{ plugins: Record<string, boolean>; source: AdoptSource }> {
 	const project = await getEnabledPlugins(projectPath).catch(() => ({}));
@@ -165,6 +180,19 @@ async function collectEnabledPlugins(
 export async function adoptCurrentProject(
 	projectPath: string,
 	name?: string,
+	/**
+	 * Manifest to add the adopted profile to. Omitted, adoption starts from an
+	 * empty manifest — correct for a repo that has none.
+	 *
+	 * This parameter is what makes adoption reachable twice. Without it the
+	 * function always returned `emptyManifest()` plus one profile, so calling
+	 * it on a repo that HAD profiles would have deleted them, and the zero-
+	 * profile gate in `ensureManifest` was the only thing preventing that.
+	 * Existing profiles are preserved untouched; only `id` is written.
+	 */
+	into?: ProfileManifest,
+	/** Profile id to write. Defaults to the adopted-profile id. */
+	id: string = ADOPTED_PROFILE_ID,
 ): Promise<AdoptResult> {
 	const { plugins: enabledPlugins, source } =
 		await collectEnabledPlugins(projectPath);
@@ -181,8 +209,26 @@ export async function adoptCurrentProject(
 		name,
 	});
 
-	const manifest = emptyManifest();
-	manifest.profiles[ADOPTED_PROFILE_ID] = entry;
+	// Copy rather than mutate the caller's manifest: this function does not
+	// write, and a caller that declines the plan must be left with the file it
+	// had, not a version already carrying the profile it refused.
+	const manifest: ProfileManifest = into
+		? { ...into, profiles: { ...into.profiles } }
+		: emptyManifest();
+	manifest.profiles[id] = entry;
+
+	// Record which profile the project wants, but ONLY when nothing has said yet.
+	//
+	// Writing it on a first adoption is the point: the manifest is committed, and
+	// a teammate who clones it should get this profile without being asked. It is
+	// the answer the repo now has.
+	//
+	// Overwriting an existing `default` would be different — one developer saving
+	// their local state would republish the team's committed choice as whatever
+	// they happened to have on. The new profile still becomes active for them,
+	// because activation is per-developer; the declared intent is not theirs to
+	// change by accident.
+	if (manifest.default === undefined) manifest.default = id;
 
 	const skipped = Object.entries(enabledPlugins)
 		.filter(([id, on]) => on && !id.includes("@"))
@@ -190,7 +236,7 @@ export async function adoptCurrentProject(
 
 	return {
 		manifest,
-		profileId: ADOPTED_PROFILE_ID,
+		profileId: id,
 		entry,
 		source,
 		counts: {